As an Identify domain administrator, you can manage users in Oracle Identity Management and assign predefined roles to users while creating them. When a user has access to Cloud EPM Planning, Service Administrators can grant roles to many users at the same time. Which two statements are true about user and group security?

In Oracle EPM Cloud, security management is layered. Predefined roles (Service Administrator, Power User, User, Viewer) establish the maximum level of access a user can have. These predefined roles are represented as system-generated groups within Access Control, allowing administrators to view their membership. This aligns with statement B. Application-level security, which is managed at the business process level (e.g., Planning), grants users access to specific artifacts like forms, business rules, and dashboards. This access is additive and operates within the permissions granted by the user's predefined role. For example, a user with the "Viewer" role can be granted access to see a specific form. This enhances their access by allowing them to view that artifact, but it does not reduce their fundamental role permissions. This supports statement D.

A. Assigning roles at the business process level grants access to specific artifacts; it does not reduce the fundamental permissions granted by a user's predefined role.
C. Access Control is the central utility for managing security, which includes adding service users and groups as members of other groups to streamline permissions management.

1. Oracle Cloud Administering Access Control for Oracle Enterprise Performance Management Cloud, EPM-CAC, Chapter 2: Managing Users and Roles. This chapter details how identity domain users are managed and assigned roles. It explicitly states, "Predefined roles are listed as groups in Access Control." This directly supports option B.

2. Oracle Cloud Administering Access Control for Oracle Enterprise Performance Management Cloud, EPM-CAC, Chapter 1: Understanding User and Role Management. This section explains the security layers: "A user's effective permissions are the union of all their applicable permissions." This concept of a "union" of permissions supports the additive nature of security, as described in option D, where business process level assignments enhance access.

3. Oracle Cloud Administering Planning, FAPLA, Chapter 11: Securing Planning. This chapter describes how application-level security works. It states, "You grant users access to Planning artifacts... A user's predefined role determines the maximum access the user can have to an artifact." This confirms that application-level security grants access within the boundaries of the predefined role, thus enhancing it, not reducing it. This supports option D and refutes option A.